What are the roadblocks to a ‘vaccine passport’?

With all American adults soon to be eligible for COVID-19 vaccines and businesses and international borders reopening, a fierce debate has kicked off across the United States over whether a digital health certificate (often and somewhat misleadingly called a “vaccine passport”) should be required to prove immunization status.

Currently, Americans are issued a white paper card as evidence of their COVID-19 shots, but these can easily be forged, and online scammers are already selling false and stolen vaccine cards.

While the federal government has said it will not introduce digital vaccine passports by federal mandate, a growing number of businesses — from cruise lines to sports venues — say they will require proof of vaccinations for entry or services. Hundreds of digital health pass initiatives are scrambling to launch apps that provide a verified electronic record of immunisations and negative COVID-19 test results to streamline the process.

The drive has raised privacy and equity concerns and some states like Florida and Texas have banned businesses from requiring vaccination certificates. But developers argue that the digital infrastructure is secure and will help speed up the process of reopening society and reviving travel.

Governments, technology companies, airlines and other businesses are testing different versions of the digital health passes and are trying to come up with common standards so that there is compatibility between each system and health records can be pulled in a safe and controlled format.

The process comes with great technical challenges, especially because of the sheer number of app initiatives underway. For the certificates to be useful, countries, airlines and businesses must agree on common standards and the infrastructure they use will need to be compatible. In the United States, there is an added complexity of getting individual states to share immunisation data with different certificate platforms while maintaining the privacy of residents.

Here’s what we know about the current status of digital health passes and some of the roadblocks they are facing in the United States.

Can I get a vaccine passport?

For the moment, only if you live in New York. Last month, it became the first state in the United States to launch a digital health certificate called the Excelsior Pass, which verifies a person’s negative coronavirus test result and if they are fully vaccinated.

The app and website is free and voluntary for all New York residents, and provides a QR code that can be scanned or printed out to verify a person’s health data. The pass has been used by thousands of New Yorkers to enter Yankee Stadium, Madison Square Garden and other smaller public venues.

Most businesses require people to show their state ID along with their Excelsior Pass to prevent potential fraud.

In Israel, where more than half the population is fully vaccinated, residents must show an electronic “Green Pass” to attend places such as gyms, concerts, wedding halls and to dine indoors. As part of its plans to reopen to foreign visitors, Israel has said it will require them to take a blood test upon arrival proving that they have been vaccinated. Once a vaccine certificate is introduced for travelers, the test will no longer be required.

The European Union has endorsed the idea of an electronic vaccine certificate, which could be ready by June, but each individual member country will be able to set its own rules for travel requirements. Britain has also started testing a COVID-19 certificate system that aims to help businesses reopen safely.

Some airlines including Lufthansa, Virgin Atlantic and Jet Blue have started to use the digital health app, Common Pass, to verify passenger COVID-19 test results before they board flights. The International Air Transport Association’s Health Pass is being tested by more than 20 airlines and will allow passengers to upload health credentials necessary for international travel.

Are they legal?

It depends on state regulations. The Biden administration has said there will be no federal vaccination system or mandate. Individual states hold primary public health powers in the United States and have the authority to require vaccines.

“We expect a vaccine passport, or whatever you want to call it, will be driven by the private sector,” Jen Psaki, the White House press secretary, said at a recent briefing. “There will be no centralised, universal federal vaccinations database and no federal mandate requiring everyone to obtain a single vaccination credential.”

Earlier this month, Gov Greg Abbott of Texas issued an executive order banning government agencies, private businesses and institutions that receive state funding from requiring people to show proof that they have been vaccinated against the coronavirus.

Ron DeSantis, the Florida governor, issued a similar order, saying that requiring proof of vaccination would “reduce individual freedom” and “harm patient privacy” as well as “create two classes of citizens based on vaccinations.”

But those orders may not stick. “The governors are on shaky legal ground,” said Lawrence Gostin, the director of the O’Neill Institute for National and Global Health Law at Georgetown University. “Certainly, the Legislature has authority to regulate businesses in the state, and it can also preempt counties and local governments from issuing vaccine passports. But a governor, acting on his or her own, has no inherent power to regulate businesses other than through emergency or other health powers that the Legislature gives them.”

Where will the information come from?

In the United States, there is no centralised federal vaccine database. Instead, the states collect that information. All states except New Hampshire have their own immunisation registries and some cities, like New York, have their own.

Currently states are required to share their registries with the Centers for Disease Control and Prevention, but the data is not public and could be withheld.

That means anyone developing a digital vaccine certificate in the United States would have to obtain immunisation data from individual states, which could be problematic in states that oppose health pass initiatives.

Why are people opposed?

One of the issues is with terminology. A passport is issued by a government and certifies personal data including a person’s legal name and date of birth. Many people fear that if they are required to have one related to the coronavirus, they will be handing over personal and sensitive health data to private companies that could be stolen or used for other purposes.

“There are a whole lot of valid concerns about how privacy and technology would work with these systems, especially as Silicon Valley does not have a great history delivering technologies that are privacy enhancing,” said Brian Behlendorf, executive director of Linux Foundation Public Health, an open-source, technology-focused organisation.

“And the concept of privacy here is complicated because you are ultimately trying to prove to somebody that you received something,” he said. “You aren’t keeping a secret, so the challenge is to present and prove something without creating a chain of traceability forever that might be used.”

The Linux Foundation is working with a network of technology companies called the COVID-19 Credentials Initiative to develop a set of standards for preserving privacy in the use of vaccine certificates. The main aim of the initiative is to establish a verifiable credential (much like a card in one’s wallet) that contains a set of claims about an individual but is digitally native and cryptographically secure.

Some argue that such a credential would intrude on personal freedoms and private health choices.

“‘Vaccine passports’ must be stopped,” former Rep Ron Paul of Texas wrote in a Tweet last week. “Accepting them means accepting the false idea that government owns your life, body and freedom.”

Others worry that an exclusively digital system would leave some communities behind, especially those who do not have access to smartphones or the internet.

“Any solutions in this area should be simple, free, open source, accessible to people both digitally and on paper, and designed from the start to protect people’s privacy,” Jeff Zients, the White House coronavirus coordinator, said in a statement.

The World Health Organisation said it does not back requiring vaccination passports for travel yet because of the uncertainty over whether inoculation prevents transmission of the virus, as well as equity concerns.

© 2021 The New York Times Company